CVE-2026-84347 in Chrome
Summary
by MITRE • 09/02/2026
Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as a use-after-free flaw within the WebRTC component of Google Chrome prior to version 152.0.7977.75 represents a critical memory management error that can be leveraged by remote attackers to achieve arbitrary code execution. This specific class of vulnerabilities occurs when a program continues to use a pointer after it has been freed, leading to undefined behavior that often results in the corruption of heap data structures or the execution of malicious payloads injected into the reclaimed memory space. In the context of WebRTC, which handles real-time communication protocols including audio, video, and data channels, such an error can be triggered through complex interactions between JavaScript APIs and underlying C++ implementations when processing specially crafted media streams or signaling messages embedded within a hostile HTML page.
From a technical perspective, this flaw aligns with the Common Weakness Enumeration identifier CWE-416, which describes use after free scenarios where memory is deallocated but references to that memory remain active. The attacker crafts an HTML page containing malicious JavaScript and WebRTC-specific payloads designed to manipulate object lifecycles within the browser engine. By carefully timing the allocation and deallocation of specific objects involved in media processing or peer connection management, the adversary can force the application to access freed heap regions. If the allocator reuses that memory for a new object with controlled content, the attacker gains control over how subsequent operations interpret that data, potentially leading to arbitrary write primitives or code execution within the browser's sandboxed environment.
The operational impact of this vulnerability is severe due to its remote exploitability and potential for privilege escalation relative to the user context. Although modern browsers employ robust sandboxing mechanisms such as site isolation and process separation, a successful exploitation can allow an attacker to escape these restrictions under certain conditions or execute code with the privileges of the browser process itself. This could lead to data exfiltration, installation of persistent malware, or further lateral movement within a network if the compromised machine is part of a larger infrastructure. The Chromium security severity rating of Medium reflects the balance between exploit complexity and impact, acknowledging that while exploitation requires specific conditions like crafted HTML pages, the consequences are significant enough to warrant immediate attention.
This vulnerability maps directly to several techniques in the MITRE ATT&CK framework, particularly T1203 which covers Exploitation for Client Execution, where attackers leverage vulnerabilities in client software to run malicious code on a victim's system. Additionally, it relates to memory corruption exploitation patterns often seen in advanced persistent threats aiming to bypass security controls like DEP and ASLR through heap spraying or structure overwrite techniques facilitated by the use-after-free condition. The ability to execute arbitrary code via a simple web page interaction underscores the importance of rigorous input validation and secure coding practices within browser engines, especially for components handling untrusted external data streams like WebRTC.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.75 or later, where these memory management issues have been addressed through code patches that ensure proper reference counting and nullification of pointers after deallocation. Organizations should enforce automated patching policies for all endpoints running the affected browser versions to minimize exposure windows. For users unable to update immediately, disabling WebRTC functionality via browser settings can reduce the attack surface by preventing the execution of potentially malicious media handling routines. Furthermore, deploying web application firewalls and content security policies that restrict script execution from untrusted sources can provide an additional layer of defense against drive-by exploitation attempts targeting this specific vulnerability class.